Earlier this week, several Facebook users learned that their personal information — including public profiles, likes, birthdays and locations —was compromised as a result of either they or their friends using the personality quiz app “This Is Your Digital Life.”

But it appears the privacy breach may have been even more serious than that, with the app’s creator, data scientist and psychologist Aleksandr Kogan, reportedly collecting direct messages between Facebook users.

Kogan told the New York Times on Tuesday that he harvested messages from around “a couple thousand” people for a Cambridge University research project, exploring how people use emojis to convey emotion.

The Moldovan-born Kogan, whose academic career included a stint as a post-doctoral fellow at the University of Toronto, later went on to work for Cambridge Analytica, but he told the Times that the information he shared with the controversial data mining firm only comprised names, birthdays, locations and likes — not direct messages.

Story continues below advertisement

In March, Kogan told CNN’s Anderson Cooper that he didn’t even know that Cambridge Analytica was looking to use the data to build profiles of voters to target political ads more precisely, although he was aware the data would be used for “political consulting.”

On Wednesday, Facebook CEO Mark Zuckerberg told U.S. Congress that the social media giant was looking into taking legal action against Kogan, and would “be doing a full audit to make sure that he gets rid of all the data that … he has, as well.”